Re: [PATCH] don't corrupt heap upon empty response from OCSP server

2012-07-06 Thread Jim Meyering
Joe Orton wrote: Hi Jim, On Thu, Jul 05, 2012 at 01:49:25PM +0200, Jim Meyering wrote: This is my first httpd patch/report. If you'd prefer that it go to a BZ or a different list, just let me know. This is fine! I found this by inspection: it appears that line[-1] (the heap) can

Re: [PATCH] don't access(r/w) uri[-1] when validating resource w/empty uri string

2012-07-06 Thread Jim Meyering
Nick Kew wrote: On Thu, 05 Jul 2012 19:33:18 +0200 Jim Meyering j...@meyering.net wrote: Thanks for the patch, but can you clarify? At first I thought there must be code to guarantee that a URI (resource-uri) has length 0, In principle it must be for an HTTP request to exist. Have you

[PATCH] don't corrupt heap upon empty response from OCSP server

2012-07-05 Thread Jim Meyering
use a new number. Also, I didn't know of a recommended method for finding a number for the new diagnostic, so I did a quick and dirty: git grep -w APLOGNO|sed 's/.*APLOGNO.//'|sort -nr|head From 71485156919f20d2e0bf57370f5d520d0bff1da0 Mon Sep 17 00:00:00 2001 From: Jim Meyering meyer

[PATCH] don't access(r/w) uri[-1] when validating resource w/empty uri string

2012-07-05 Thread Jim Meyering
5609908643d8456c6f56197102161e56d87e56c4 Mon Sep 17 00:00:00 2001 From: Jim Meyering meyer...@redhat.com Date: Thu, 7 Jun 2012 20:36:16 +0200 Subject: [PATCH] don't access(r/w) uri[-1] when validating resource w/empty uri string * modules/dav/main/util.c (dav_validate_resource_state): Handle a zero-length URI string. --- modules